CISM Practice Test 20 — 15 Questions

Question 1

An organization uses CIS Controls v8. They are a small business with limited cybersecurity resources. Which implementation group (IG) should they prioritize?

Accepted Answer

IG1. IG1 is the basic set of cyber hygiene controls designed for organizations with limited resources.

Answer

All IGs simultaneously

Answer

IG3

Answer

IG2

Question 2

Which control framework is most appropriate for an organization that wants a prioritized set of controls based on implementation groups (IG1, IG2, IG3)?

Accepted Answer

CIS Controls v8. CIS Controls v8 explicitly defines implementation groups to help organizations prioritize controls based on their risk profile and resources.

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Question 3

In a third-party risk management programme, what is the primary purpose of vendor tiering?

Accepted Answer

To prioritize which vendors require more rigorous security assessments. Vendor tiering categorizes vendors based on the criticality of services and data access to determine the appropriate level of due diligence and monitoring. This ensures resources are focused on high-risk vendors.

Answer

To assign responsibility for vendor management to different teams

Answer

To ensure all vendors receive the same level of oversight

Answer

To determine the vendor's pricing structure

Question 4

Which of the following is the PRIMARY purpose of a security awareness program?

Accepted Answer

To reduce human-related security risks. The primary purpose is to change employee behavior to reduce human-related security risks, such as phishing susceptibility.

Answer

To achieve compliance with regulatory requirements

Answer

To increase the security team's visibility

Answer

To document training completion for audits

Question 5

A security architect is designing a defense-in-depth strategy. Which combination of controls best exemplifies this approach?

Accepted Answer

Firewall, antivirus, encryption, and security awareness training. Defense-in-depth uses multiple layers of security. Firewall (network), antivirus (host), encryption (data), and security awareness (human) provide overlapping layers.

Answer

Physical security, background checks, and non-disclosure agreements

Answer

Encryption, data loss prevention, and backup

Answer

Firewall, intrusion detection system, and SIEM

Question 6

A financial institution uses CIS Controls v8 and must prioritize implementation. The organization has limited resources and high exposure to ransomware. Which implementation group should be addressed FIRST?

Accepted Answer

Implementation Group 1 (IG1). IG1 consists of essential controls (e.g., inventory, malware defenses) that address the most common attacks, including ransomware.

Answer

All groups simultaneously

Answer

Implementation Group 3 (IG3)

Answer

Implementation Group 2 (IG2)

Question 7

An organization is redesigning its information security program to better align with business objectives. The CISO reports to the CIO, but business leaders feel security decisions are too IT-centric. Which reporting structure would best address this concern?

Accepted Answer

CISO reports directly to the CEO or Board of Directors.. Reporting to the CEO or Board gives the CISO independence from IT and better alignment with business strategy.

Answer

CISO reports to the Chief Risk Officer (CRO).

Answer

CISO reports to the Chief Operating Officer (COO).

Answer

CISO continues reporting to CIO but with a dotted line to the Board.

Question 8

An organization is implementing a security champions program to improve application security. Which THREE of the following are key success factors for such a program?

Accepted Answer

Ensuring that champions have authority to stop releases with critical vulnerabilities.. Security champions need dedicated time, training, and management support to be effective. Champions act as liaisons between security and development.

Answer

Rotating champions every quarter to maximize exposure.

Answer

Selecting champions only from senior management.

Question 9

Which control selection framework includes implementation groups (IG1, IG2, IG3) that help organizations prioritize controls based on their risk profile?

Accepted Answer

CIS Controls v8. CIS Controls v8 organizes controls into Implementation Groups (IG1, IG2, IG3) to guide prioritization. NIST SP 800-53 uses families, and ISO 27001 uses Annex A controls.

Answer

COBIT 2019

Answer

NIST SP 800-53

Answer

ISO 27001 Annex A

Question 10

A CISO is evaluating security metrics for reporting to the board. Which TWO of the following are leading indicators?

Accepted Answer

Phishing simulation click rate. Leading indicators are proactive measures. Phishing click rate predicts future breaches, and patch compliance indicates current vulnerability posture. Breach count and MTTD are lagging, and number of security tools is not a performance metric.

Answer

Mean time to detect (MTTD) incidents

Answer

Number of data breaches in the past quarter

Answer

Number of security tools deployed

Question 11

Which security team role is primarily responsible for defining and maintaining security architecture standards?

Accepted Answer

Security architect. The security architect designs the security architecture, ensuring that security controls are integrated into systems and networks.

Answer

GRC analyst

Answer

Security analyst

Answer

Penetration tester

Question 12

A security manager is designing an executive security report. Which content is most appropriate for a one-page C-suite dashboard?

Accepted Answer

Top security risks and key performance indicators with trends. C-suite executives need high-level strategic insights, not operational details. Top risks and key metrics (e.g., risk posture, critical incidents) are suitable for a dashboard.

Answer

Detailed logs of all security incidents from the past week

Answer

List of all vulnerabilities found during the last scan

Answer

Full results of the latest phishing simulation

Question 13

A CISO is preparing the security budget for the next fiscal year. The current IT budget is $10 million. For a mature security program, what is the recommended security budget range?

Accepted Answer

$1 million to $1.5 million. Best practice for a mature security program is to allocate 10-15% of the IT budget to security. For a $10 million IT budget, that is $1 million to $1.5 million.

Answer

$500,000 to $750,000

Answer

$100,000 to $200,000

Answer

$2 million to $3 million

Question 14

In a defence-in-depth strategy, which control is considered a compensating control when a critical application cannot be patched immediately due to operational constraints?

Accepted Answer

Network segmentation. Compensating controls provide alternative protection when a primary control cannot be applied. Network segmentation limits the blast radius and reduces the attack surface until patching can occur.

Answer

Configuration management

Answer

Intrusion detection system (IDS)

Answer

Vulnerability scanning

Question 15

A CISO is evaluating a cloud provider's security posture. Which of the following should be the MOST important consideration in the vendor risk assessment?

Accepted Answer

The provider's certifications and SOC 2 reports. The provider's certifications and independent audits provide objective evidence of security controls, which is critical for trust.

Answer

The provider's data center locations

Answer

The provider's market share and brand reputation

Answer

The provider's pricing compared to competitors